Re: [TLS] (selection criteria for crypto primitives) Re: sect571r1

[Tony Arcieri <[e-mail]>]

On Wed, Jul 15, 2015 at 6:42 PM, Rene Struik <[e-mail]> wrote:

> Dear colleagues:
>
> It seems prudent to keep some diversity of the gene pool and not only have
> curves defined over prime curves. Similarly, one should perhaps have some
> diversity of gene pool criteria within the set of recommend curves and not
> only include special primes. Should some problem with a particular subclass
> show up over time, one then at least has other classes available.


I just responded to Dan Brown with this, but it applies here as well:

---------- Forwarded message ----------
From: Tony Arcieri <[e-mail]>
Date: Wed, Jul 15, 2015 at 6:46 PM
Subject: Re: [TLS] sect571r1
To: Dan Brown <[e-mail]>
Cc: Martin Rex <[e-mail]>, "<[e-mail]>" <[e-mail]>


On Wed, Jul 15, 2015 at 6:42 PM, Dan Brown <[e-mail]> wrote:

> Even so, there's an argument from Koblitz and Menezes that special curves
> (e.g. binary curves) may survive some wider collapse. I think it's a weak
> argument, but for those for whom supporting more curves is easy, it could
> justify supporting a diversity of curves.


Others are pushing FFDHE in the event of some ECC disaster. I'm not really
a fan of that either (all these things add attack surface in addition to
being "backups"), but if we're going to keep a little used thing around in
our pocket just in case of an ECC disaster, why do we need backup curves in
addition to FFDHE?

-- 
Tony Arcieri